IS Https://IP/query support HTTP/3 ?

I'm use host to request https://MyHost/ the networkProtocolName return "h3"

assumesHTTP3Capable = YES

- (void)URLSession:(NSURLSession *)session
       task:(NSURLSessionTask *)task
didFinishCollectingMetrics:(NSURLSessionTaskMetrics *)metrics AF_API_AVAILABLE(ios(10), macosx(10.12), watchos(3), tvos(10))
{
for (NSURLSessionTaskTransactionMetrics * m in metrics.transactionMetrics){
       
     if(m.networkProtocolName.length > 0){
        NSLog(@"networkProtocolName %@", m.networkProtocolName);
        break;
      }
    }
}

but when I use ip replace MyHost to request, and add MyHost to http header @{@"host": "ip"}, the networkProtocolName return "h2"

- (void)URLSession:(NSURLSession *)session
       task:(NSURLSessionTask *)task
didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge
 completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition disposition, NSURLCredential *credential))completionHandler
{
 NSURLSessionAuthChallengeDisposition disposition = NSURLSessionAuthChallengePerformDefaultHandling;
    NSURLCredential *credential = nil;


   //get header host replace ip
    NSString *host = [[task.currentRequest allHTTPHeaderFields] objectForKey:@"host"];
    if (!host) {
      host = task.currentRequest.URL.host;
    }
    if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
      if ([weak evaluateServerTrust:challenge.protectionSpace.serverTrust forDomain:host]) {
        disposition = NSURLSessionAuthChallengeUseCredential;
        credential = [NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust];
      } else {
        disposition = NSURLSessionAuthChallengePerformDefaultHandling;
      }
    } else {
      disposition = NSURLSessionAuthChallengePerformDefaultHandling;
    }


    // 对于其他的 challenges 直接使用默认的验证方案
    completionHandler(disposition,credential);
}

-(BOOL)evaluateServerTrust:(SecTrustRef)serverTrust forDomain:(NSString *)domain {


  //创建证书校验策略
  NSMutableArray *policies = [NSMutableArray array];
  if (domain) {
    [policies addObject:(__bridge_transfer id)SecPolicyCreateSSL(true, (__bridge CFStringRef)domain)];
  } else {
    [policies addObject:(__bridge_transfer id)SecPolicyCreateBasicX509()];
  }


  //绑定校验策略到服务端的证书上
  SecTrustSetPolicies(serverTrust, (__bridge CFArrayRef)policies);


  //评估当前 serverTrust 是否可信任,
  //官方建议在 result = kSecTrustResultUnspecified 或 kSecTrustResultProceed 的情况下 serverTrust 可以被验证通过,
  //https://developer.apple.com/library/ios/technotes/tn2232/_index.html
  //关于SecTrustResultType的详细信息请参考SecTrust.h
  SecTrustResultType result;
  SecTrustEvaluate(serverTrust, &result);


  return (result == kSecTrustResultUnspecified || result == kSecTrustResultProceed);
}

https://ip/ networkProtocolName return "h2" does ip request do not supprt HTTP/3?

hope to respone thank you.

Answered by DTS Engineer in 734846022

but when I use ip replace MyHost to request, and add MyHost to http header @{@"host": "ip"}, the networkProtocolName return h2

I think the answer here is “Don’t do that.” The Host header is on our list of Reserved HTTP Headers. Sometimes it’s OK to bend those rules [1] but sometimes doing that yields unexpected results, which is the case here.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] For example, the ongoing problem with implementation custom authorisation schemes, which isn’t possible without setting the Authorization header.

Accepted Answer

but when I use ip replace MyHost to request, and add MyHost to http header @{@"host": "ip"}, the networkProtocolName return h2

I think the answer here is “Don’t do that.” The Host header is on our list of Reserved HTTP Headers. Sometimes it’s OK to bend those rules [1] but sometimes doing that yields unexpected results, which is the case here.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] For example, the ongoing problem with implementation custom authorisation schemes, which isn’t possible without setting the Authorization header.

sorry, fixed the host info, but when I use ip replace MyHost to request, and add MyHost to http header @{@"host": "MyHost"}, the networkProtocolName return h2

After you use IP replace MyHost, the QUIC connection will remove the Server Name Indication extension in the initial stage. But the HTTP3 RFC requires SNI extension MUST send to server (https://www.rfc-editor.org/rfc/rfc9114.html#name-connection-establishment) in order to establish connection.

That's the difference between two requests, looks like a bug in iOS system framework.

IS Https://IP/query support HTTP/3 ?
 
 
Q